What is the lawful basis for processing your personal data?

The health board will only process your personal information where we are able to do so by law, under the legal basis available through the Data Protection Act 2018 and UK General Data Protection Regulation 2016 (UK GDPR).

The legal bases we use most often to collect information are:

entering into and managing our employment contract
legal obligations where processing is necessary for compliance, for example, informing HMRC of your tax and National Insurance contributions
when we process personal information based on your consent. We will always tell you where this is the case and ask you to agree before we process it. Where we have used consent as the lawful basis for processing your information, you have the right to withdraw your consent at any time
where its necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller
where the health board may rely on its legitimate interests, where a formal assessment has been made and recorded

Where we process sensitive personal or special categories of data about you, we will ensure this is done only where one of the following conditions applies:

processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller, or the data subject, in the field of employment and social security and social protection law
processing is necessary for the purposes of preventive or occupational medicine, assessment of the working capacity of the employee, or the provision of health or social care